Skip to content

Commit 2c4da92

Browse files
helmut-hoffer-von-ankershoffenhelmut-hoffer-von-ankershoffen
authored
Ketryx Integration
* chore(gha): Spike for Ketryx integration * chore(gha): Allow to skip jobs/steps via commit message, see CONTRIBUTING.md * fix(platform): Fix broken pytest collection if user does not have permission to access aignx test bucket
1 parent bd74063 commit 2c4da92

31 files changed

Lines changed: 515 additions & 186 deletions

‎.github/workflows/_audit.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
fetch-depth: 0
1919

2020
- name: Install uv
21-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
21+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
2222
with:
2323
version: "0.6.3"
2424
enable-cache: true

‎.github/workflows/_ketryx_report_and_check.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: "Report build to Ketryx and check for approval"
2+
3+
on:
4+
workflow_call:
5+
# No inputs needed at this time
6+
7+
env:
8+
# https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15
9+
PYTHONIOENCODING: "utf8"
10+
11+
jobs:
12+
13+
ketryx_report_and_check:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
packages: read
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Download test results for ubuntu-latest generated in _test.yml
25+
uses: actions/download-artifact@v4
26+
with:
27+
name: test-results-ubuntu-latest
28+
29+
- name: Download audit results generated in _audit.yml
30+
uses: actions/download-artifact@v4
31+
with:
32+
name: audit-results
33+
34+
- name: Report build to Ketryx and check for approval
35+
uses: Ketryx/ketryx-github-action@v1.4.0
36+
with:
37+
project: ${{ secrets.KETRYX_PROJECT }}
38+
api-key: ${{ secrets.KETRYX_API_KEY }}
39+
build-name: "ci-cd"
40+
check-dependencies-status: true
41+
test-junit-path: reports/junit_*.xml
42+
cyclonedx-json-path: |
43+
reports/sbom.json
44+
artifact-path: |
45+
reports/sbom.spdx
46+
reports/licenses.csv
47+
reports/licenses.json
48+
reports/licenses_grouped.json
49+
reports/vulnerabilities.json
50+
reports/mypy_junit.xml
51+
reports/coverage.xml
52+
reports/coverage.md
53+
aignostics.log

‎.github/workflows/_lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
fetch-depth: 0
1919

2020
- name: Install uv
21-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
21+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
2222
with:
2323
version: "0.6.3"
2424
enable-cache: true

‎.github/workflows/_package-publish.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
fetch-depth: 0
4545

4646
- name: Install uv
47-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
47+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
4848
with:
4949
version: "0.6.3"
5050
enable-cache: true
@@ -88,7 +88,7 @@ jobs:
8888
fetch-depth: 0
8989

9090
- name: Install uv
91-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
91+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
9292
with:
9393
version: "0.6.3"
9494
cache-dependency-glob: uv.lock
@@ -153,11 +153,14 @@ jobs:
153153
shell: bash
154154
run: make dist
155155

156-
157156
- name: Publish distribution to Python Package Index at pypi.org
158157
shell: bash
159158
run: uv publish -t ${{ secrets.UV_PUBLISH_TOKEN }}
160159

160+
- name: Download test results for ubuntu-latest generated in _test.yml
161+
uses: actions/download-artifact@v4
162+
with:
163+
name: test-results-ubuntu-latest
161164

162165
- name: Have audit checks publish to reports/ for auditing
163166
shell: bash

‎.github/workflows/_scheduled-audit.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
fetch-depth: 0
1818

1919
- name: Install uv
20-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
20+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
2121
with:
2222
version: "0.6.3"
2323
enable-cache: true

‎.github/workflows/_scheduled-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
fetch-depth: 0
1818

1919
- name: Install uv
20-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
20+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
2121
with:
2222
version: "0.6.3"
2323
enable-cache: true

‎.github/workflows/_test.yml‎

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,27 @@ env:
1010

1111
jobs:
1212

13+
generate-matrix:
14+
runs-on: ubuntu-latest
15+
outputs:
16+
matrix: ${{ steps.set-matrix.outputs.matrix }}
17+
steps:
18+
- name: Set matrix based on commit message
19+
id: set-matrix
20+
run: |
21+
if [[ "${{ github.event.head_commit.message }}" == *"skip:test:matrix-runner"* ]]; then
22+
echo 'matrix={"runner":["ubuntu-latest"],"experimental":[false]}' >> $GITHUB_OUTPUT
23+
else
24+
echo 'matrix={"runner":["ubuntu-latest"],"experimental":[false],"include":[{"runner":"ubuntu-24.04-arm","experimental":true},{"runner":"macos-latest","experimental":true},{"runner":"macos-13","experimental":true},{"runner":"windows-latest","experimental":true},{"runner":"windows-11-arm","experimental":true}]}' >> $GITHUB_OUTPUT
25+
fi
26+
1327
test:
28+
needs: generate-matrix
1429
runs-on: ${{ matrix.runner }}
1530
continue-on-error: ${{ matrix.experimental }}
1631
strategy:
1732
fail-fast: false
18-
matrix:
19-
runner: [ubuntu-latest]
20-
experimental: [false]
21-
include:
22-
- runner: ubuntu-24.04-arm
23-
experimental: true
24-
- runner: macos-latest
25-
experimental: true
26-
- runner: macos-13
27-
experimental: true
28-
- runner: windows-latest
29-
experimental: true
30-
- runner: windows-11-arm
31-
experimental: true
33+
matrix: ${{ fromJSON(needs.generate-matrix.outputs.matrix) }}
3234
permissions:
3335
attestations: write
3436
contents: read
@@ -41,7 +43,7 @@ jobs:
4143
fetch-depth: 0
4244

4345
- name: Install uv
44-
uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
46+
uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
4547
with:
4648
version: "0.6.3"
4749
enable-cache: true
@@ -117,6 +119,7 @@ jobs:
117119
uv run --all-extras aignostics application run list --verbose --limit 1
118120
119121
- name: Test / regular
122+
if: (!contains(github.event.head_commit.message, 'skip:test:regular'))
120123
shell: bash
121124
run: |
122125
set +e
@@ -146,6 +149,7 @@ jobs:
146149
exit $EXIT_CODE
147150
148151
- name: Test / long running
152+
if: (!contains(github.event.head_commit.message, 'skip:test:long-running'))
149153
shell: bash
150154
run: |
151155
set +e
@@ -181,7 +185,7 @@ jobs:
181185
name: test-results-${{ matrix.runner }}
182186
path: |
183187
reports/mypy_junit.xml
184-
reports/junit.xml
188+
reports/junit_*.xml
185189
reports/coverage.xml
186190
reports/coverage.md
187191
reports/coverage_html

‎.github/workflows/ci-cd.yml‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ on:
1515
jobs:
1616

1717
lint:
18-
if: (!contains(github.event.head_commit.message, '[skip ci]'))
18+
if: (!contains(github.event.head_commit.message, 'skip:ci'))
1919
uses: ./.github/workflows/_lint.yml
2020
permissions:
2121
contents: read
@@ -24,7 +24,7 @@ jobs:
2424
secrets: inherit
2525

2626
audit:
27-
if: (!contains(github.event.head_commit.message, '[skip ci]'))
27+
if: (!contains(github.event.head_commit.message, 'skip:ci'))
2828
uses: ./.github/workflows/_audit.yml
2929
permissions:
3030
contents: read
@@ -33,7 +33,7 @@ jobs:
3333
secrets: inherit
3434

3535
test:
36-
if: (!contains(github.event.head_commit.message, '[skip ci]'))
36+
if: (!contains(github.event.head_commit.message, 'skip:ci'))
3737
uses: ./.github/workflows/_test.yml
3838
permissions:
3939
attestations: write
@@ -44,7 +44,7 @@ jobs:
4444

4545

4646
codeql:
47-
if: (!contains(github.event.head_commit.message, '[skip ci]'))
47+
if: (!contains(github.event.head_commit.message, 'skip:ci'))
4848
uses: ./.github/workflows/_codeql.yml
4949
permissions:
5050
actions: read
@@ -54,12 +54,25 @@ jobs:
5454
secrets: inherit
5555

5656

57-
package_publish:
57+
ketryx_report_and_check:
5858

5959
needs: [lint, audit, test, codeql]
6060

61+
uses: ./.github/workflows/_ketryx_report_and_check.yml
62+
if: (!contains(github.event.head_commit.message, 'skip:ci'))
63+
permissions:
64+
attestations: write
65+
contents: write
66+
id-token: write
67+
packages: write
68+
secrets: inherit
69+
70+
package_publish:
71+
72+
needs: [ketryx_report_and_check]
73+
6174
uses: ./.github/workflows/_package-publish.yml
62-
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, '[skip ci]')))
75+
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, 'skip:ci')))
6376
permissions:
6477
attestations: write
6578
contents: write
@@ -69,9 +82,9 @@ jobs:
6982

7083
docker_publish:
7184

72-
needs: [lint, audit, test, codeql]
85+
needs: [ketryx_report_and_check]
7386

74-
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, '[skip ci]')))
87+
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, 'skip:ci')))
7588
uses: ./.github/workflows/_docker-publish.yml
7689
permissions:
7790
attestations: write

0 commit comments

Comments
 (0)